4 ms·

qmail contained a buffer overflow that allowed remote root access, prevented only by having a low limit on available memory. http://web.archive.org/web/2016040

qmail contained a buffer overflow that allowed remote root access, prevented only by having a low limit on available memory. http://web.archive.org/web/20160401021400/http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html http://web.archive.org/web/20160401021400/http://www.guninsk... djb is a smart and motivated guy and even he isn't quite capable of writing correct C code; how much chance does anyone else have?

10019310231 10y ago
qmail is supposed to be used with "softlimit" from daemontools. All decent tutorials mention that. Again, which C++ program has been even analyzed to that level?
- SamReidHughes 10y ago
  Did it ever occur to you that if a C++ programmer of security mindset wanted to make something like postfix or qmail, they'd just pick a language that was garbage collected?
  - 101291091 10y ago
    No, it did not occur to me. The reason is precisely that I have not seen this mindset among C++ programmers, at least in the open source world. Llvm is an exception. What I do see is hubris. They are overconfident and pretend that one can use C++ like Haskell, i.e. one can safely go ahead and pile one abstraction onto another. C programmers at least know the limitations of their language. This is the just impression that I and many others get. I'm sure there are counterexamples.